There are 3 major solutions for this which are mod_ntlm, mod_auth_kerb and Apache2:AuthenNTLMI tried mod_ntlm which seemed to be very easy to setup and worked well. But there was one catchIf the browser did not send the NTLM information or correct NTLM information, see the footnotes1 below as to why, the user had to login with the username in the form of DOMAINusername. In my experience with applications already in place they did not require this form of DOMAINusername. This could be resolved if you could specify the default domain in mod_ntlm which you cannot.

Now I will explain why there is a Part 2 to this topic. I used the Apache2::AuthenNTLM Apache Perl module in a large environment and quickly found a serious problem which I could not diagnose or resolve. When using the Apache2::AuthenNTLM Perl module Apache would stop responding to requests to the site after an undetermined number of requests. I tried limiting the file types that would be authenticated but in the end it would still stop reaponding after a while.

So I finally decided to use the Apache mod_ntlm module to handle the authentication. And with the article I had written titled Enabling NTLM Authentication (Single Sign-On) in Firefox, the problem with having to use the username in the form of DOMAINusername in Firefox can be eliminated.

This how to is intended for CentOS 4 and RHEL4 but can be easily adapted for other distributions.

Now for the HowTo:

1) Start by installing Apache by issuing the following command:yum install httpd

Modify the conf like so (the documentation in the conf pretty much covers it also):

<location ~ "/path/to/dir/to/protect/here)/(.*)" >
# NTLMAuth - set to 'on' to activate NTLM authentication here
NTLMAuth on
# AuthNTGroups - text file containing (NT) group names and member user IDs
# NTLMBasicAuth - set to 'on' to allov Basic authentication too
# NTLMBasicRealm - realm to use for Basic authentication
# NTLMAuthoritative - set to 'off' to allow access control to be passed along to lower modules if the UserID is not known to this module
NTLMAuthoritative on
# NTLMDomain - set to the domain you want users authenticated against for cleartext authentication - if not specified, the local machine, then all trusted domains are checked
NTLMDomain MYDOMAIN
# NTLMServer - set to the NT server to contact to authenticate users
NTLMServer primary.mydomain.com
# NTLMBackup - set to the alternate NT server to contact to authenticate users
NTLMBackup secondary.mydomain.com
# NTLMLockFile - set to the lock file that is used to prevent simutaneous contacts to DC
NTLMLockfile /tmp/_mod_ntlm.lck
AuthName NTAuth
AuthType NTLM
require valid-user
Satisfy all
</location>

4) We need to modify the global conf file now.vi /etc/httpd/conf/httpd.conf
Find 'KeepAlive Off' and change it to 'KeepAlive On'

Footnotes
1. Getting a login prompt can be caused by using Firefox with the default configuration, not being logged on in the domain that you are attempting to authenticate against, or not having the site listed in the Local Intranet security zone in Internet Explorer. Or worst of all you could have mis configured something in step 3